Permissions
Workflow and job permissions, trust boundaries, and review gates.
Loading record
Manual service · Live billing
Loading record
Reliability review · One bounded workflow
A manual review loop for technical founders who need one coding-agent GitHub Actions workflow to stay least-privileged, cost-bounded, and review-gated as it changes. Below is one drawn to scale: the shaded area is what the agent job's token can reach if a single step misbehaves.
Enrollment is open. Checkout can create a live $1,000 monthly subscription.
One misbehaving step in the agent job can commit straight to the default branch. Inside the radius: main, releases, ghcr.io and cloud role.
The most dangerous edge in agent CI is a privileged trigger that runs contributor code. Here is the bridge that builds it, drawn in section, and the two ways of not building it.
Contributor-authored code executes on privileged ground, where it can read every secret the workflow references. Across the bridge: secrets.*, GITHUB_TOKEN and branch cache.
pull_request_target runs the job in the base repository's context, where the workflow is privileged: it may hold repository write access and access to the secrets it references, even for a pull request from a fork. Checking out github.event.pull_request.head.sha then executes contributor-authored code inside that context. GitHub's own instruction for this trigger is that it must not explicitly check out untrusted code.
A token cap is not a budget. Thirty days of inference spend, poured into a graduated column, against a ceiling drawn at the height the budget maps to rather than wherever it looked right.
Nothing stops the pour. The $500.00 line is crossed on day 6 and the ink is off the plate by day 9; the 30-day projection is $2,937.60. There is no cost control in this workflow.
Every figure here is a synthetic example, and the inputs are printed so the arithmetic can be redone by hand: runs per day times tokens per run times the blended rate. The ceiling is not placed on the drawing — it is the height $500.00 maps to on the printed scale, which is why the numeral beside it and the rule cannot disagree.
Twenty runs, oldest first. Flakes that arrive together are a property of the workflow rather than of the change under test, so the chart bands them and names the runs they are.
How to read it
5 of 20 runs flaked and they arrive together: runs 3–5 (3 runs), runs 12–13 (2 runs). A band that long is a property of the workflow, not of the change under test — the longest is runs 3–5. The 2 hard failures sit outside every band.
| Run | Outcome | Duration | Flake cluster |
|---|---|---|---|
| 1 | passed first attempt | 11.4 minutes | — |
| 2 | passed first attempt | 10.9 minutes | — |
| 3 | failed, then passed on re-run of the same commit | 17.2 minutes | runs 3–5 |
| 4 | failed, then passed on re-run of the same commit | 18.6 minutes | runs 3–5 |
| 5 | failed, then passed on re-run of the same commit | 16.1 minutes | runs 3–5 |
| 6 | passed first attempt | 11.8 minutes | — |
| 7 | passed first attempt | 10.2 minutes | — |
| 8 | passed first attempt | 12.5 minutes | — |
| 9 | failed and stayed failed | 6.4 minutes | — |
| 10 | passed first attempt | 11.1 minutes | — |
| 11 | passed first attempt | 12.0 minutes | — |
| 12 | failed, then passed on re-run of the same commit | 19.4 minutes | runs 12–13 |
| 13 | failed, then passed on re-run of the same commit | 17.9 minutes | runs 12–13 |
| 14 | passed first attempt | 11.6 minutes | — |
| 15 | passed first attempt | 10.7 minutes | — |
| 16 | passed first attempt | 13.2 minutes | — |
| 17 | passed first attempt | 11.9 minutes | — |
| 18 | failed and stayed failed | 5.8 minutes | — |
| 19 | passed first attempt | 12.4 minutes | — |
| 20 | passed first attempt | 11.0 minutes | — |
A synthetic window of twenty runs, not a customer's history. The bands are not drawn by eye: a cluster is a maximal run of consecutive flakes two or more long, and the band spans exactly the cells of the runs it names — which is why it can be labelled with them.
The review surface
Workflow and job permissions, trust boundaries, and review gates.
Exposure risks and safer patterns—without asking for secrets or tokens.
Model, budget, and run-level controls that keep inference spend bounded.
Up to 20 recent runs in the baseline, using customer-authorized evidence.
Zero-credential boundary
No manufactured urgency
One plan, a visible set of exclusions, and live monthly checkout.
Read the full scope